horizon3.ai
Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-10-21.
| Date Added | Resource | Excerpt |
|---|---|---|
| 2026-10-21 2026 | CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCERCE | Writeup of CVE-2026-106173 details a critical arbitrary file write vulnerability in Fortinet FortiSIEM, exploitable via an unauthenticated gRPC service on port 27918. Attackers can leverage path traversal and null byte injection to overwrite critical system files, such as `/opt/charting/redishb.sh`, ultimately leading to remote code execution by manipulating files executed by cron jobs. |
| 2026-10-15 2026 | AhsayCBS Deep-Dive: Auth Bypass to RCEAuthZRCE | Writeup of CVE-2026-105133 and CVE-2026-105134, detailing an authentication bypass vulnerability in AhsayCBS API components and a file write path traversal leading to remote code execution. Attackers can chain these flaws to write webshells into the application's filesystem, enabling SYSTEM and root command execution. The analysis unpacks the Java application's structure, identifies the authentication bypass in the `JSONApi.execute()` method via the "FromServlet":"Y" flag, and explains how `AddSysUser` allows creating new administrators without verification. It further details the path traversal in `FileService.a()` and `getReplicatedPath()`, demonstrating how to write malicious `.jsp` files into web-served directories, ultimately leading to webshell execution. |
| 2026-10-08 2026 | CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCEAuthNRCE | Writeup of CVE-2026-102489 detailing a session hijack vulnerability in Zammad. This vulnerability, when triggered by a crafted WebSocket request, leaks session cookies from error messages, allowing attackers to obtain valid admin session cookies. These cookies can then be used to write arbitrary files to the application directory, specifically by overwriting the password reset email template, leading to remote code execution as the `zammad` user through Ruby's ERB rendering. |
| 2026-09-02 2026 | Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586RCE | Writeup detailing CVE-2026-9586, an unauthenticated SQL injection leading to remote code execution in Sangoma Switchvox. The vulnerability arises from direct concatenation of the `PhoneIP` field, extracted from XML notifications, into unparameterized SQL queries. The analysis includes exploit examples, indicators of compromise found in `/var/log/switchvox/db-quirks.log`, and observations of active exploitation attempts in the wild. |
| 2026-04-22 2026 | CVE-2026-34197: ActiveMQ RCE via Jolokia APIRCE | Writeup detailing CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic. Exploitation leverages the Jolokia API to invoke `addNetworkConnector` with a crafted `vm://` URI, forcing the broker to fetch and execute a remote Spring XML configuration file. This technique, similar to CVE-2023-46604, allows arbitrary OS command execution. The vulnerability is unauthenticated on ActiveMQ versions 6.0.0–6.1.1 due to CVE-2024-32114. |
| 2026-04-06 2026 | CVE-2026-20131 Cisco FMC RCE VulnerabilityRCE | Writeup of CVE-2026-20131, a critical RCE vulnerability in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. This insecure deserialization flaw in the web interface allows unauthenticated remote attackers to execute arbitrary code as root, and has been observed in ransomware campaigns. The vulnerability affects specific Cisco FMC and Security Cloud Control Firewall Management versions, with Cisco issuing software updates as the sole remediation. |